With enforce-storage-engine mysql_upgrade corrupts the schema: ALTER TABLE should either bypass enforce-storage-engine, or mysql_upgrade should refuse to run

Currently if enforce_storage_engine is set, ALTER TABLE will switch the table to the enforced engine. It's a point of huge user errors, but even worse, it will make mysql_upgrade create a mess – it will attempt to ALTER system tables, will convert them to the enforced engine, and it will break the instance.

I suppose it would be right if enforce_storage_engine did not affect ALTER TABLE – the point of this option is not to allow creating new "wrong" tables, while existing ones should, if needed, be converted manually and carefully, rather than automatically by an unrelated operation.

If it's technically impossible to skip enforcing for ALTER TABLE, at the very least mysql_upgrade should handle it correctly – either refuse to run with the option, or unset it before running and reset afterwards. But there will still be a lot of room for human mistakes.